DRUPAL-CONTRIB-2021-008 This module enables you to add customizable facets on search pages, from core search or searches provided by Search API.
An attacker with admin facets permission can inject malicious scripts due to insufficient output filtering in the Drupal facets module.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2021-008?
DRUPAL-CONTRIB-2021-008 is a cross-site scripting vulnerability in drupal/facets, published on 12 May 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
This module enables you to add customizable facets on search pages, from core search or searches provided by Search API.
The module doesn't sufficiently filter all output in certain circumstances.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer facets".
Which versions are affected by DRUPAL-CONTRIB-2021-008?
Linux distribution packages (1)
drupal/facets Packagist:https://packages.drupal.org/8 | All versions | 1.8.0 |
How do I fix DRUPAL-CONTRIB-2021-008?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is DRUPAL-CONTRIB-2021-008 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2021-008 in the wild and no public exploit code.